Hello
We have Weird problem with NAT on CISCO 7200 router, If we permit only one subnet for NAT and deny all others, the filtering is not working and any IP can do NATing
you can see this clearly from "show ip nat translations"
Pro Inside global Inside local Outside local Outside global
icmp xx.xx.61.2:0 64.0.96.42:0 201.19.11.100:0 201.19.11.100:0
icmp xx.xx.61.2:0 64.0.96.42:0 203.59.89.117:0 203.59.89.117:0
icmp xx.xx.61.2:0 64.0.96.42:0 204.96.151.138:0 204.96.151.138:0
icmp xx.xx.61.2:0 64.0.96.42:0 213.10.113.206:0 213.10.113.206:0
tcp xx.xx.61.2:113 64.0.96.42:113 134.181.128.1:33639 134.181.128.1:33639
tcp xx.xx.61.2:113 64.0.96.42:113 209.139.92.14:64944 209.139.92.14:64944
tcp xx.xx.61.2:139 64.0.96.42:139 xx.xx.185.108:4865 xx.xx.185.108:4865
tcp xx.xx.61.2:445 64.0.96.42:445 xx.xx.191.202:2823 xx.xx.191.202:2823
udp xx.xx.61.2:1032 64.0.96.42:1032 64.4.12.201:7001 64.4.12.201:7001
tcp xx.xx.61.8:135 64.132.47.202:135 xx.xx.186.156:1530 xx.xx.186.156:1530
tcp xx.xx.61.8:445 64.132.47.202:445 xx.xx.52.12:3102 xx.xx.52.12:3102
udp xx.xx.61.7:1434 217.139.226.243:1434 222.174.115.18:1032 222.174.115.18:1032
tcp xx.xx.61.7:3128 217.139.226.243:3128 59.188.4.140:60257 59.188.4.140:60257
tcp xx.xx.61.2:1100 172.16.16.216:1902 69.90.63.96:80 69.90.63.96:80
tcp xx.xx.61.2:1174 172.16.16.216:1903 67.15.14.45:80 67.15.14.45:80
udp xx.xx.61.2:1904 172.16.16.216:1904 xx.xx.42.2:53 xx.xx.42.2:53
udp xx.xx.61.2:1905 172.16.16.216:1905 xx.xx.42.2:53 xx.xx.42.2:53
tcp xx.xx.61.2:2464 172.16.16.205:2464 204.127.202.26:25 204.127.202.26:25
tcp xx.xx.61.2:2465 172.16.16.205:2465 66.148.71.105:8712 66.148.71.105:8712
We permit only 172.16.0.0/16 network but we have other ip addresses in nat translations like 64.0.96.42 , 64.132.47.202 and 217.139.226.243
here is the configuration of the router which is running IOS c7200-js-mz.123-8.T3
aaa new-model
!
aaa authentication ppp default group radius local
aaa authorization network default group radius local
aaa accounting network default start-stop group radius
aaa session-id unique
ip subnet-zero
!
bba-group pppoe PRIVATE_IP
virtual-template 1
!
interface GigabitEthernet0/1
bandwidth 100000
ip address x.x.x.x x.x.x.x
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
media-type rj45
no negotiation auto
no keepalive
no cdp enable
!
interface ATM1/0
no ip address
no atm ilmi-keepalive
!
interface ATM1/0.1 multipoint
range pvc 10/35 10/135
protocol pppoe group PRIVATE_IP
!
range pvc 12/35 12/135
protocol pppoe group PRIVATE_IP
!
range pvc 13/35 13/135
protocol pppoe group PRIVATE_IP
!
!
interface Virtual-Template1
ip unnumbered GigabitEthernet0/1
ip access-group 112 in
ip mtu 1492
ip nat inside
ip virtual-reassembly
peer ip address forced
peer default ip address pool PRIVATE_IP_POOL
ppp authentication pap chap
!
ip local pool PRIVATE_IP_POOL 172.16.0.1 172.16.255.254
!
ip nat pool NAT_POOL xx.xx.61.1 xx.xx.61.254 netmask 255.255.255.0
ip nat inside source list 111 pool NAT_POOL overload
!
access-list 111 permit ip 172.16.0.0 0.0.255.255 any
access-list 111 deny ip any any
access-list 112 deny ip any 192.168.0.0 0.0.255.255
access-list 112 deny ip any 172.16.0.0 0.15.255.255
access-list 112 deny ip any 10.0.0.0 0.255.255.255
access-list 112 permit ip 172.16.0.0 0.0.255.255 any
access-list 112 deny ip any any
We have Weird problem with NAT on CISCO 7200 router, If we permit only one subnet for NAT and deny all others, the filtering is not working and any IP can do NATing
you can see this clearly from "show ip nat translations"
Pro Inside global Inside local Outside local Outside global
icmp xx.xx.61.2:0 64.0.96.42:0 201.19.11.100:0 201.19.11.100:0
icmp xx.xx.61.2:0 64.0.96.42:0 203.59.89.117:0 203.59.89.117:0
icmp xx.xx.61.2:0 64.0.96.42:0 204.96.151.138:0 204.96.151.138:0
icmp xx.xx.61.2:0 64.0.96.42:0 213.10.113.206:0 213.10.113.206:0
tcp xx.xx.61.2:113 64.0.96.42:113 134.181.128.1:33639 134.181.128.1:33639
tcp xx.xx.61.2:113 64.0.96.42:113 209.139.92.14:64944 209.139.92.14:64944
tcp xx.xx.61.2:139 64.0.96.42:139 xx.xx.185.108:4865 xx.xx.185.108:4865
tcp xx.xx.61.2:445 64.0.96.42:445 xx.xx.191.202:2823 xx.xx.191.202:2823
udp xx.xx.61.2:1032 64.0.96.42:1032 64.4.12.201:7001 64.4.12.201:7001
tcp xx.xx.61.8:135 64.132.47.202:135 xx.xx.186.156:1530 xx.xx.186.156:1530
tcp xx.xx.61.8:445 64.132.47.202:445 xx.xx.52.12:3102 xx.xx.52.12:3102
udp xx.xx.61.7:1434 217.139.226.243:1434 222.174.115.18:1032 222.174.115.18:1032
tcp xx.xx.61.7:3128 217.139.226.243:3128 59.188.4.140:60257 59.188.4.140:60257
tcp xx.xx.61.2:1100 172.16.16.216:1902 69.90.63.96:80 69.90.63.96:80
tcp xx.xx.61.2:1174 172.16.16.216:1903 67.15.14.45:80 67.15.14.45:80
udp xx.xx.61.2:1904 172.16.16.216:1904 xx.xx.42.2:53 xx.xx.42.2:53
udp xx.xx.61.2:1905 172.16.16.216:1905 xx.xx.42.2:53 xx.xx.42.2:53
tcp xx.xx.61.2:2464 172.16.16.205:2464 204.127.202.26:25 204.127.202.26:25
tcp xx.xx.61.2:2465 172.16.16.205:2465 66.148.71.105:8712 66.148.71.105:8712
We permit only 172.16.0.0/16 network but we have other ip addresses in nat translations like 64.0.96.42 , 64.132.47.202 and 217.139.226.243
here is the configuration of the router which is running IOS c7200-js-mz.123-8.T3
aaa new-model
!
aaa authentication ppp default group radius local
aaa authorization network default group radius local
aaa accounting network default start-stop group radius
aaa session-id unique
ip subnet-zero
!
bba-group pppoe PRIVATE_IP
virtual-template 1
!
interface GigabitEthernet0/1
bandwidth 100000
ip address x.x.x.x x.x.x.x
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
media-type rj45
no negotiation auto
no keepalive
no cdp enable
!
interface ATM1/0
no ip address
no atm ilmi-keepalive
!
interface ATM1/0.1 multipoint
range pvc 10/35 10/135
protocol pppoe group PRIVATE_IP
!
range pvc 12/35 12/135
protocol pppoe group PRIVATE_IP
!
range pvc 13/35 13/135
protocol pppoe group PRIVATE_IP
!
!
interface Virtual-Template1
ip unnumbered GigabitEthernet0/1
ip access-group 112 in
ip mtu 1492
ip nat inside
ip virtual-reassembly
peer ip address forced
peer default ip address pool PRIVATE_IP_POOL
ppp authentication pap chap
!
ip local pool PRIVATE_IP_POOL 172.16.0.1 172.16.255.254
!
ip nat pool NAT_POOL xx.xx.61.1 xx.xx.61.254 netmask 255.255.255.0
ip nat inside source list 111 pool NAT_POOL overload
!
access-list 111 permit ip 172.16.0.0 0.0.255.255 any
access-list 111 deny ip any any
access-list 112 deny ip any 192.168.0.0 0.0.255.255
access-list 112 deny ip any 172.16.0.0 0.15.255.255
access-list 112 deny ip any 10.0.0.0 0.255.255.255
access-list 112 permit ip 172.16.0.0 0.0.255.255 any
access-list 112 deny ip any any